Two-way SSL clarification
Both certificates should exist prior to the connection. They’re usually created by Certification Authorities (not necessarily the same). (There are alternative cases where verification can be done differently, but some verification will need to be made.) The server certificate should be created by a CA that the client trusts (and following the naming conventions defined … Read more